Compliance tools · Cybersecurity and data protection

Toolkit for ISO 27001

ISO/IEC 27001:2022 · European Union and United Kingdom · Voluntary standard

Name anyone on your staff. The system makes them your compliance person.

A member of your own staff, with no compliance background, reads the training module, answers the interview, and finishes with your Toolkit for ISO 27001 documentation cited clause by clause. The knowledge stays in the business.

Every account level runs inside a dedicated Claude account. Anyone can try a toolkit in their own Claude account; compliance work runs in a dedicated one. The Claude Max plan is £90 a month, paid to Anthropic, and is not included in any level.

See a finished report before you pay

Toolkit for ISO 27001 is ISO/IEC 27001:2022, a voluntary standard in the European Union and United Kingdom. Information security management system standard. Voluntary, widely required contractually. The toolkit runs alongside your own licensed copy of the ISO standard.

The free assessment screens for Toolkit for ISO 27001 when a business handles personal data, or makes or supplies products or services with digital elements, or operates in a critical or essential sector.

This is a voluntary standard rather than binding law. Businesses adopt it because customers, insurers or public buyers ask for it.

Screen your business against all 116 agent toolkits, free →

• Your exact position under Toolkit for ISO 27001: what is in place, what is missing, and what to do about each gap.
• Documentation with clause citations, ready for auditors, insurers, customers and public buyers.
• A trained person inside the business who understands what the standard requires, and stays.
• A dated record of every section completed, with the reports themselves staying in your own Claude account. The toolkit is carried by an account level, see the plans.
• All of it completed in-house, at your own pace, without booking a single meeting.

Check that Toolkit for ISO 27001 applies to your business, free →

Does Toolkit for ISO 27001 apply to my business?

You apply ISO/IEC 27001 to yourself if you wish to establish, operate, maintain and continually improve an information security management system (Clause 1). It is voluntary, so no law forces you to hold certification, but enterprise supply chains, government procurement bodies and regulated-sector customers increasingly demand it.

Who does ISO 27001 apply to?

It applies to any organisation, regardless of type, size or nature, that wishes to establish, operate, maintain and continually improve an ISMS (Clause 1). Private companies, public bodies and not-for-profit entities may all seek conformity or certification, and the standard is sector-agnostic.

Does Toolkit for ISO 27001 apply to a small business?

The standard has no size threshold. It is explicitly scalable, so a small organisation may operate a proportionate ISMS without the overhead required by a large enterprise, and certification remains optional for SMEs.

When does ISO 27001 apply from, and what are the deadlines?

The current edition, ISO/IEC 27001:2022, was published on 25 October 2022. Under IAF MD 26:2023 the transition period opened on 30 April 2023, no new certifications to the 2013 version may be issued after 30 April 2024, and all 2013 certificates expire or must be transitioned by 31 October 2025.

What does ISO 27001 require me to do?

You must operate a management system across Clauses 4 to 10, covering context, leadership, planning, support, operation, performance evaluation and improvement. You must consider every Annex A control during risk treatment and document its inclusion or exclusion in a Statement of Applicability (Clause 6.1.3(d)).

What records or documents does ISO 27001 require me to keep or produce?

You must keep documented information for the ISMS (Clause 7) and produce a Statement of Applicability recording your decision on every Annex A control (Clause 6.1.3(d)). You must also keep the information security policy (Clause 5.2) and records of internal audits (Clause 9.2) and management reviews (Clause 9.3).

What happens if I do not comply with ISO 27001?

ISO is not a regulator and imposes no fines. A minor nonconformity requires corrective action, typically within 90 days, while a major nonconformity may stop the certificate being issued or continued until resolved, typically within six months, and unresolved cases can lead to suspension and then withdrawal.

Does Toolkit for ISO 27001 apply to a UK business selling into the EU?

The standard is international and no geographic restriction applies, so a UK business selling into the EU can certify to it. National adoptions such as BS EN ISO/IEC 27001 and DIN EN ISO/IEC 27001 are technically identical, and the IAF Multilateral Recognition Arrangement means one certificate is recognised across signatory countries.

Does Toolkit for ISO 27001 apply to an EU business selling into the UK?

An EU business selling into the UK can certify to the same international standard, because no geographic restriction applies and national adoptions are technically identical. A certificate issued by an accredited body in one IAF MLA signatory country is recognised in the others, so separate certifications for different markets are not needed.

How is ISO 27001 different from ISO 27002?

ISO/IEC 27002:2022 provides implementation guidance for each of the 93 Annex A controls, whereas ISO 27001 states what the controls must achieve. The 2022 edition of 27002 restructured controls from 114 across 14 domains to 93 across 4 themes and introduced control attributes for filtering.

How do I start complying with ISO 27001?

The first practical step is to define the context of your organisation and its ISMS under Clause 4, since the management system requirements begin there. From that context you plan the risk assessment and risk treatment (Clause 6) and then document your control decisions in the Statement of Applicability (Clause 6.1.3(d)).

Which ComplianceSME account includes the Toolkit for ISO 27001 toolkit?

The Toolkit for ISO 27001 agent toolkit is included from the Medium level.

Related in cybersecurity and data protection: GDPR · ePrivacy Directive · NIS2 Directive · CER Directive